Oblivious Transfer and Quantum Channels 
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Abstract — We show that oblivious transfer can be seen as the 
classical analogue to a quantum channel in the same sense as 
non-local boxes are for maximally entangled qubits. 

I. Introduction 

A. Quantum Entanglement and Non-Locality 

One of the most interesting and surprising consequences of 
the laws of quantum physics is the phenomenon of entangle- 
ment. In 1935, Einstein, Podolsky, and Rosen [6] initiated a 
discussion on non-local behavior. Let us consider, for instance, 
the following, maximally entangled state, called singlet or, 
alternatively, EPR or Bell state: 



^=(|01>-|10» 



(1) 



The state ) has the property that when the two qubits 
are measured in the same basis, the measurements lead to per- 
fectly anti-correlated results — even when the two measurement 
events are spatially separated. The conclusion of [6] was that 
quantum physics was incomplete in the sense that it should 
be augmented by certain hidden parameters determining the 
results of measurements. However, it was shown later by von 
Neumann [15], Gleason [7], Specker [12], Jauch and Piron [8], 
Bell [2], and Kochen and Specker [9] that such hidden- 
parameter models fail to explain quantum-physical behavior 
in general. 

The behavior of a bipartite quantum state under measure- 
ments can be described by a conditional probability distri- 
bution Pxy\uv — a l so called two-party information-theoretic 
primitive — where U and V denote the chosen bases and X 
and Y the corresponding outcomes (see Figure 
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Fig. 1. A two-party information-theoretic primitive. 

Bell [2] was the first to recognize that there exist pairs 
of measurement bases such that the resulting behavior is not 
local, i.e., cannot be explained by shared classical information 



(see Figure [2). He showed that there exist certain inequalities 
(now called Bell inequalities') that cannot be violated by any 
local system, but which are violated when an EPR pair is 
measured. 
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Fig. 2. A local system. 

The behavior of \if>~) is, hence, non-local. It is important to 
note that non-local behavior, although explainable classically 
only by communication, does not allow for signaling. In 
order to understand non-locality and its consequences better, 
Popescu and Rohrlich [10] have introduced a "non-locality 
machine," called non-local box or NL box for short. The 
behavior of the NL box is inspired by the one of but it 

is "more non-local" than the one of any quantum state. The 
(binary) inputs and outputs of the NL box are (U, V) and 
(X, Y), respectively, and X and Y are random bits satisfying 

Prob[X = Y|(C/,V)^(l,l)] = 1, 
Prob[X = Y\(U,V) = (1,1)] = 0. 

In other words, X and Y satisfy X © Y = U ■ V. 

Using such NL boxes, we can understand Bell's theorem in 
very intuitive way, since the CHSH Bell inequality corresponds 
to an upper bound on the success probability of simulating an 
NL box. 

Let the inputs to the NL box be chosen at random. Let us 
first look at the classical simulation of an NL box. It is easy to 
see that a randomization of the strategies does not improve the 
probability of a correct output. Therefore, both A and B just 
have two values — one for input and one for input 1 — that 
they will output. Since there is always a pair of inputs such 
that the output of the two players is wrong, they can achieve 
an accuracy of at most 0.75. If the players have access to an 
EPR state \ip~), they can carry out measurements in bases that 
are rotated with respect to each other by the angle of tt/8, and 



get an accuracy of 

cos 2 w 0.85 . (2) 

Furthermore, it has been shown that one call to an NL box 
allows for perfectly simulating the joint behavior of a singlet 
state under arbitrary von Neumann measurements [5]. It is, 
therefore, fair to say that the NL box is the classical analogue 
of a Bell state. 

B. Oblivious Transfer 

Oblivious transfer, introduced by Wiesner [16] under the 
name of "multiplexing" and by Rabin [11], is a primitive 
of paramount importance in cryptography, in particular two- 
and multi-party computation. In chosen l-out-of-2 oblivious 
transfer or ( 2 )— OT for short, one party, called the sender, 
has two binary inputs b and b\, whereas the other party, the 
receiver, inputs a choice bit c. The latter then learns b c but 
no additional information, while the sender remains ignorant 
about c. 





(D-OT 




- 





- 


- 



Fig. 3. Chosen l-out-of-2 oblivious transfer. 

OT has been shown universal for multi-party computation, 
i.e., any secure computation can be carried out if OT is 
available. An example is secure function evaluation, which 
is an important special case of multi-party computation, and 
where a number of players want to secretly and correctly 
evaluate a function to which each player holds an input; here, 
"secretly" means that no (unnecessary) information about the 
players' inputs is revealed. 

In this note, we are interested in OT from the viewpoint 
of communication complexity rather than cryptography. In 
particular, the described reductions are not cryptographic: a 
party can obtain more information than specified. 

In [17], it has been shown that ( 2 )-OT and the NL box 
are roughly the same primitive in a cryptographic sense, i.e., 
one can be reduced to the other. An interesting and somewhat 
surprising consequence thereof is that ( 2 )— OT, just as the 
NL box, is symmetric: ( 2 )— OT from A to B can be perfectly 
reduced to a sing le instance of ( 2 )-OT from B to A [18]. 

In terms of communication complexity, we have the fol- 
lowing reductions. ( 2 )— OT can be reduced to one realization 
of an NL box plus one bit of (classical) communication as 
follows. Let (&0i bi) and c be the parties' inputs for ( 2 )— OT. 
Then they input bo © b\ and c to the NL box, respectively, and 
receive the outputs X and Y with X © Y = (bo © b\)c. The 
first party then sends X © b to the other, who computes 

(X © b ) © Y = b © (&o © h)c = b c , 

as desired. 



Conversely, ( 2 )— OT can be used to realize an NL box. 
If the inputs to the latter are u and v, then the parties input 
(r, r © u) (where r is a random bit) and v to the ( 2 )— OT. 
The sender's output is then r, and the receiver's output is his 
output from ( 2 )— OT, i.e., r © uv. We, hence, have for the 
outputs that 

r © (r © uv) = uv , 

as requested. 

C. Classical Teleportation 

Quantum teleportation [3] is the simulation of sending a 
qubit over a quantum channel, using a shared EPR pair and two 
bits of classical communication. Classical teleportation [4] 
is the term used for the following reduction. Given a box 
simulating the classical behavior of an EPR pair, e.g., a 
singlet \ip~), and one bit of classical communication, one can 
simulate sending a qubit over a quantum channel and carrying 
out a von Neumann measurement on the received qubit. The 
idea is as follows [4]: Alice chooses, for her part of the EPR 
pair, a measurement basis consisting of the state she wants 
to send and its orthogonal complement, and communicates 
the outcome to Bob, who inverts his measurement result if 
and only if Alice has measured the state orthogonal to the 
one to be sent. Together with the result that an NL box 
allows for simulating the behavior of an EPR pair under 
von Neumann measurements, this leads to a realization of 
classical teleportation with one use of an NL box and one bit of 
classical communication. When another — weaker — result, by 
Bacon and Toner [13], is used stating that the EPR behavior 
under projective measurements can be simulated using one bit 
of communication, then one obtains the possibility of classical 
teleportation using two bits of classical communication. 

II. Connection between Oblivious Transfer and 
Quantum Channels 

In this section we show that — instead of one NL box and 
one classical bit of communication — one oblivious transfer 
(and shared randomness) is enough to perfectly simulate a 
quantum channel with a von Neumann measurement. Note 
that our discussion in the previous section shows that this is 
a strictly weaker primitive. 

Furthermore, in the case of an NL box and EPR pairs, the 
inverse is true as well, with identical success probabilities: 
Using a quantum channel, one can simulate oblivious transfer 
with a probability of about 0.85, whereas with a classical 
channel one cannot be better than 0.75. 

We can, therefore, conclude that oblivious transfer is the 
classical analogue to a quantum channel, in the same way as 
an NL box is for the EPR pair. 

A. Simulating a Quantum Channel using Oblivious Transfer 

The reduction of classical teleportation to ( 2 ) — OT works 
as follows. Let l\ and l 2 be two random vectors on the 
Poincare sphere, and let l± := l\ ± l 2 - (These vectors are 
the randomness shared by the two parties.) Let va and vb 
be the vectors determining the state Alice wants to send and 



the measurement Bob wants to perform, respectively. Then the 
inputs to (,) — OT are as shown in Figure^ (Here, sg denotes 
the signum function.) 



Sg{vA ■ k) 
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Fig. 4. Reducing classical teleportation to oblivious transfer. 

Bob's output is the bit 

z®sg(v B • /+) © 1 . 

We have 

Z = Bg(vA-h)®[sg(vA'h)®Sg(vA'h)][sg(VB-l+)®8g(VB-l-)] ■ 

Hence, we obtain the same expression as in [4] (see also [13]). 

B. Simulating Oblivious Transfer using a Quantum Channel 

Let now Alice and Bob be connected by a quantum channel 
over which they are allowed to send exactly one qubit. They 
want to simulate OT (with an error as small as possible) with 
Alice as sender and Bob as receiver. Alice has inputs bo and 
b\ and Bob c, i.e., Bob wants to know b c . Alice takes a qubit 
\4>) = |0) and rotates it by an angle of 



She gets 



b ,b 1 ):=-(2b + 4b 1 -3) . (3) 



cos(0(6o,6i))|O)+sin(^(6o,fei))|l> (4) 



and send \<j>) to Bob. If c = 1, Bob applies a Hadamard 
transform on \<j>) and leaves it unchanged otherwise. He then 
measures \<p) in the computational basis and outputs the 
outcome of this measurement. It is easy to verify that his 
output is equal to b c with a probability of 



COS" 



(!) 



0.85 



(5) 



which is the same as for the simulation of an NL box using 
an EPR pair. 

If Alice and Bob are only allowed to communicate one 
classical bit, the best Alice can do is to choose one of the 
two input bits and send it to Bob. Therefore, Bob will only be 
able to output the correct value b c with probability 0.75, if all 
inputs are random. Again, we get the same success probability 
as for the NL box without an EPR pair. Results related to ours 
were obtained in [1]. 



III. Concluding Remarks and Open Problems 

We have shown that bit oblivious transfer can be seen as the 
classical analogue of sending a qubit over a quantum channel 
in the same sense as the NL box is for measuring an EPR 
pair. 

Note that our simulation of a quantum channel does not 
preserve privacy, i.e. the players get more information than 
they would get if they had only black-box access to a quantum 
channel. It is an open problem if there is an efficient simulation 
that would also be private. 
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